New-ZrEnrollmentToken
Mints a one-time, node-bound TLS enrollment token so a node can self-enroll for TLS at first boot. Use it in attach mode (Docker/Kubernetes) to hand a new node a short-lived bootstrap credential without ever moving its private key.
Syntax
New-ZrEnrollmentToken
-Node <string>
[-TtlMinutes <int>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
Description
New-ZrEnrollmentToken mints a short-lived enrollment token bound to a single nodeId, so that node can self-enroll for TLS on first boot. In attach mode (Docker/Kubernetes) the operator mounts the token as a secret (ZARIS_TLS_ENROLL_TOKEN, alongside ZARIS_TLS_ISSUER_URL and ZARIS_TLS_CA_THUMBPRINT); the node generates its keypair locally and its private key never leaves it. The token is for first boot only — renewals are cert-based. This is cluster-admin gated: it requires an active workspace (or an explicit -Managers) whose manager has a provisioned cluster CA, and fails with an error if the cluster CA has not been provisioned.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Node | string | Yes | NodeId the enrollment token is bound to. Also accepts -NodeId. Position 0. |
-TtlMinutes | int | No | Token lifetime in minutes. Short by design — a one-time bootstrap credential. Defaults to 15 (server-side) when omitted. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Examples
Mint a 15-minute enrollment token bound to node orders-n0.
New-ZrEnrollmentToken -Node orders-n0 -TtlMinutes 15
Mint a token using the -NodeId alias.
New-ZrEnrollmentToken -NodeId orders-n0